Mozilla Firefox and Thunderbird: JIT miscompilation in JavaScript engine
Summary
A JIT miscompilation in the JavaScript engine of Mozilla Firefox and Thunderbird can be triggered by a crafted web page or script. The CVSS vector indicates that an attacker who gets a user to interact (for example by visiting a malicious site) without authentication could compromise confidentiality and integrity. Mozilla does not publish detailed exploit information, and the bug report is restricted.
Affected
- Firefox versions before 158, Firefox ESR 115.43 to before 115.x fixes, and Firefox ESR 153 before 153.5 (per the vendor CVE text)
- Thunderbird versions before 158 and Thunderbird 153 before 153.5
- Linux distribution packages may differ; Ubuntu 22.04 Thunderbird is marked vulnerable
- Mobile versions: Unknown.
Fixed in
- Firefox 158
- Firefox ESR 115.43 and ESR 153.5
- Thunderbird 158 and Thunderbird 153.5
- Distribution fixes: AlmaLinux Thunderbird 153.5.0-1.el9_2.alma.1.tuxcare.els1; openSUSE firefox-esr 153.5.0-1.1
Workaround
Unknown. No vendor-documented workaround; apply the update.
Exploitation
- Known exploited (CISA KEV): No evidence found in the sources checked.
- Public proof of concept: None found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Firefox, Firefox ESR and Thunderbird to the latest version on all workstations, prioritising internet-facing browsers.
- Check Linux distribution packages, especially Ubuntu 22.04 Thunderbird, as they may lag behind upstream.
- Monitor the Mozilla advisories and the CISA KEV catalogue for changes in exploitation status.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Scyrix-LLC/CVE-2026-109722
Research sources
- Mozilla Security Advisory MFSA 2026-106 (Firefox 158) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-107 (Firefox ESR 115.43) www.mozilla.org
- Mozilla Security Advisory MFSA 2026-109 www.mozilla.org
- Mozilla Security Advisory MFSA 2026-110 www.mozilla.org
- Ubuntu Security Notice CVE-2026-109722 ubuntu.com
- AlmaLinux OSV advisory CLSA-2026-1792779937 osv.dev
- SUSE CVE entry via Vulners vulners.com
- Mozilla bug 2074164 (restricted) bugzilla.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:53.
Original description (NVD)
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2074164
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.